Environment
Goal
Upgrade Ruby from 2.7.8 to 3.0.6.
Issues Description
After successfully installing Ruby 3.0.6, I encountered difficulties running bundle install in my Rails project due to two OpenSSL-related issues.
Could not load OpenSSL.
Bundler::Fetcher::CertificateFailureError
Issue 1: Could not load OpenSSL.
bundle install
Could not load OpenSSL.
You must recompile Ruby with OpenSSL support or change the sources in your Gemfile from 'https' to 'http'. Instructions for compiling with OpenSSL using RVM are available at rvm.io/packages/openssl.
Solution
If you're using macOS and RVM, here's how you can recompile Ruby with OpenSSL support:
1. Install the required dependencies: This is a more general command for installing openssl library on your system, potentially for use by various applications beyond Ruby.
brew install openssl
2. Install OpenSSL using RVM: This is specific to managing OpenSSL for Ruby installations through rvm.
rvm pkg install openssl
3. Install Ruby with OpenSSL support: This is use for reinstalling the required Ruby version and specify the installation location of OpenSSL.
rvm reinstall ruby-<your_version> --with-openssl-dir=$(brew --prefix openssl)
4. After the installation is complete, set the new Ruby version as the default:
rvm use <your_version> --default
5. Replace <your_version> with the version you installed.
Check if OpenSSL is linked correctly:
ruby -r openssl -e "puts OpenSSL::OPENSSL_LIBRARY_VERSION"
This should output the OpenSSL version like above, confirming that Ruby is now compiled with OpenSSL support.
These steps should help you resolve the OpenSSL-related issue on macOS with RVM.
Issue 2: Bundler::Fetcher::CertificateFailureError
After resolving the OpenSSL loading issue for the Ruby process, I attempted to run bundle install again. However, a new error surfaced.
Fetching gem metadata from https://rubygems.org/.......
Fetching https://github.com/kaikhq/omniauth-line.git
Fetching https://github.com/banister/binding_of_caller.git
Fetching https://github.com/excid3/convertkit-ruby.git
Fetching source index from https://gems.graphql.pro/
Retrying fetcher due to error (2/4): Bundler::Fetcher::CertificateFailureError Could not verify the SSL certificate for https://gems.graphql.pro/.
There is a chance you are experiencing a man-in-the-middle attack, but most likely your system doesn't have the CA certificates needed for verification. For information about OpenSSL certificates, see https://railsapps.github.io/openssl-certificate-verify-failed.html. To connect without using SSL, edit your Gemfile sources and change 'https' to 'http'.
Retrying fetcher due to error (3/4): Bundler::Fetcher::CertificateFailureError Could not verify the SSL certificate for https://gems.graphql.pro/.
There is a chance you are experiencing a man-in-the-middle attack, but most likely your system doesn't have the CA certificates needed for verification. For information about OpenSSL certificates, see https://railsapps.github.io/openssl-certificate-verify-failed.html. To connect without using SSL, edit your Gemfile sources and change 'https' to 'http'.
Retrying fetcher due to error (4/4): Bundler::Fetcher::CertificateFailureError Could not verify the SSL certificate for https://gems.graphql.pro/.
There is a chance you are experiencing a man-in-the-middle attack, but most likely your system doesn't have the CA certificates needed for verification. For information about OpenSSL certificates, see https://railsapps.github.io/openssl-certificate-verify-failed.html. To connect without using SSL, edit your Gemfile sources and change 'https' to 'http'.
Could not verify the SSL certificate for https://gems.graphql.pro/.
There is a chance you are experiencing a man-in-the-middle attack, but most likely your system doesn't have the CA certificates needed for verification. For information about OpenSSL certificates, see https://railsapps.github.io/openssl-certificate-verify-failed.html. To
connect without using SSL, edit your Gemfile sources and change 'https' to 'http'.
Solution
This was caused by "root certificate expiration" issue（Many thanks to santoshcop for providing this command.）. You can run the command below and run bundle install again. The issue will be possible to be solved.
bundle config ssl_verify_mode 0 && echo ":ssl_verify_mode: 0" > ~/.gemrc
This command is used to configure Bundler to set the SSL verification mode to 0, effectively turning off SSL certificate verification. Additionally, it writes a configuration file (~/.gemrc) that includes the SSL verification mode setting, making it persistent for future gem-related operations in the user's environment.
To lessen security risks, I turned on SSL certificate verification after resolving this issue.
bundle config ssl_verify_mode 1 && echo ":ssl_verify_mode: 1" > ~/.gemrc
Make sure the settings are configured.
bundle config ssl_verify_mode
Settings for `ssl_verify_mode` in order of priority. The top value will be used
Set for your local app (/Users/lynnbright/code/blog/.bundle/config): 1
